ARTeam Import Reconstructor - ARImpRec.dll - 32-byte Import Rebuilder
Hello all!This is a project that was created specifically for rebuilding imports for Armageddon tool.
But it can be used for any other goal if needed.
It allows rebulding any scattered IAT, you now, valid handles between lots of zeroes or garbage dwords, providing a clean IAT. As you probably are guessing, this involves fixing every address in the code pointing to these handles, and the tool allows it.
There is also the way of rebuilding as very well known ImpRec tool does, without modifying any address at the code and leaving at the same address every handle, it depends on your needs.
There is a GUI tool to perform also this tasks, very similar in appearance to ImpRec tool. The difference with that tool is this selects automatically valid handles, so no valid ones won't appear in the list.
There is also ARImpRec.dll that can be used to rebuild imports of any loaded process.
Attached two simple launchers that I use to test ARImpRec.dll, one of then for minimizing Armadillo dumps.
common.arg file included to see parameters information of functions when debugging with OllyDbg.
Check the Readme.txt for more information.
If you find any inconsistent info or some bug, please report here to let me improve the tool.
Thanks a lot! Special thanks go to LCF-AT for his help on improving lots of features.
From：Nacho_dj 不懂 英文呵呵 老大，这个文章还看不懂。一会我翻译下看看。 我翻译了一下，给大家分享下。
你好!
这是一个项目,成立专门为重建进口世界末日的工具。
但是它可以用于任何其他目的。
它允许rebulding任何分散IAT,你现在,有效处理大量的零或垃圾dword之间,提供一个干净的IAT。正如你可能猜测,这包括修复代码中的每个地址指向这些句柄,和工具允许。
还有众所周知的重建方式ImpRec工具,无需修改任何地址的代码,在相同的地址每一处理,这取决于您的需要。
也有一个GUI工具来执行这个任务,在外表上ImpRec工具非常相似。这个工具的区别是这选择自动有效的处理,所以没有有效的不会出现在列表中。
还有ARImpRec。dll可以用来重建进口的任何加载过程。
连接两个简单我用来测试ARImpRec发射器。dll,然后最小化犰狳转储。
常见的。参数文件中看到参数调试与OllyDbg时信息的功能。
检查Readme。txt的更多信息。
如果你发现任何不一致的信息或一些错误,请报告这里让我改善工具。
谢谢!特别要感谢LCF-AT他的帮助提高大量的特性。
来自:Nacho_dj 这个还不知道做什么用。 需要慢慢研究这个
页:
[1]